v3.138.2

Important security update

Upgrade to v3.138.2 promptly. This release addresses compromised eMudhra certificate chains (CVE-2026-111943) by building the agent with Go 1.26.10, which rejects the affected chains, including alternate cross-signed paths.

Installing the updated agent is required to receive this protection. It doesn't update OS, container or custom trust stores, or protect external tools run by jobs; remediate those separately.

What's Changed

🔒 Security

• Reject compromised eMudhra certificate chains (CVE-2026-111943) by building with Go 1.26.10 by @moskyb in #4551
• Prevent artifact downloads escaping their destination through directory symlinks, unless the allow-artifact-path-traversal experiment is enabled by @isaacsu in #4548
• Update github.com/lestrrat-go/jwx/v3 to 3.3.0 to fix JSON member-name escaping (GHSA-4cf7-xm37-g63h) by @dependabot[bot] in #4366
• Update github.com/klauspost/compress to fix a zstd decoder crash on crafted input (GHSA-fpmh-frq8-7rj8) by @dependabot[bot] in #4345

🏠 Internal

• Replace deprecated HTTP/2 transport configuration to unblock dependency upgrades by @isaacsu in #4547
• Dependency updates by @dependabot[bot] in #4301, #4392, #4391, #4365, #4543, #4393 and #4549

Full Changelog: v3.138.1...v3.138.2